TL;DR: What is the PHP issue, and why are websites down?
The PHP issue is a pair of flaws in PHP, the language behind WordPress and most of the web, fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both let an attacker run code on a server without logging in. Because the details leaked early and PHP says no setting fully protects you, many operators switched services off until they could patch: Pokémon HOME, Pokémon Champions and Pokémon Sleep, Cygames titles such as Umamusume, Wikimedia's support tools and government sites in at least seven European countries. Most were back within a day, the Pokémon apps included, while Wikimedia's tools and one Cygames game stay down and two older Japanese games closed for good. None of them has reported a break-in. The first confirmed compromise came from elsewhere: on 23 October Palo Alto Networks' Unit 42 said attackers broke into a European government body and took password hashes and multi-factor authentication secrets within two hours. The Dutch cyber security centre now judges large-scale abuse less likely than it first thought. On 23 October PHP flagged a third, much narrower issue, CVE-2026-115560, and asks everyone to set session.upload_progress.enabled=0 until its next regular release. Founders should patch today, and switch off any PHP site that can't be patched yet.
Last updated 5 Nov 2026, 07:40 CET. A second confirmed break-in, on an unpatched honeypot, and CISA's listing of both flaws as exploited were reported on 26 October. Wikimedia's community tools are mostly back. Nothing new has come out since 30 October: on 5 November php.net still shows no regular release with the fix for the third issue (CVE-2026-115560), so keep session.upload_progress.enabled=0 until it ships. This was our last scheduled update.
The PHP issue is why your favourite game, your city council's website and Wikipedia's tools went dark this week. "PHP issue" jumped to more than 20,000 Google searches in the US overnight, next to "websites down" and "Pokémon apps offline", and in France, the Netherlands and Germany people search for the same story in their own words.
We broke down the flaws themselves yesterday in our PHP vulnerability news and patch guide. This article covers what happened next: who went offline, why companies with big security teams chose to switch off, whether attacks are happening, and how you decide if your own startup site should go dark for a few hours.
What is the PHP issue everyone is searching for?
On 20 October 2026, PHP announced an emergency release, and on 21 October at 14:00 UTC it shipped the fix. PHP's security advisory names two bugs, both rated 9.2 out of 10 on CVSS v4.0 (the Common Vulnerability Scoring System):
- CVE-2026-109618, "RCE via OOM corruption": a crash path while PHP parses multipart requests (file uploads and forms) when memory runs out;
- CVE-2026-109619, "RCE via stale global state": internal data that PHP keeps using after its memory was freed, reachable through session upload progress, which is on by default.
RCE means remote code execution: an attacker sends a request and runs commands on your server. Researchers nicknamed the pair php2shell. The cloud security firm Wiz says it found the first bug on 19 August, reported it to PHP on 24 August, and showed takeovers of WordPress, Drupal and Joomla without a login.
Here's the detail that explains the shutdowns. PHP writes that there are no complete mitigations, so updating is the only safe choice. When the fix is the only protection and you can't install it within the hour, switching the service off is the one move left. On Ubuntu and Debian, many teams got those updates from one unpaid volunteer, Ondřej Surý, who rebuilt 12 PHP branches in about a day.
Which websites and apps went offline because of PHP?
The list grew all through 21 October, and Orange joined it on 22 October. In Japan alone, a survey by Assured reported by Mynavi TECH+ counted 502 shutdown notices on X by 14:00 JST on 23 October, and only 217 had announced a restart, which leaves about 60% without a confirmed return. Every operator we could check described its shutdown as a precaution, and none has reported a confirmed compromise so far.
Sources: Japanese gaming press (Famitsu on Cygames, which cited "system safety"), the Wikimedia Foundation's own status post, a Reuters factbox, RTÉ for Denmark, and for the 22 October updates Pokémon Sleep's own notice, Nintendo Life, Orange's newsroom, Dengeki Online, the Sony retailer blog kunkoku.jp, and for 23 October SEGA's own notice, 4Gamer, Mynavi TECH+ and The Register on the UK figures. Wikimedia wrote that it deliberately took many supporting services offline until they can be safely patched, and warned that the wikis themselves may see outages.
Some lists online also name Steam, GOG and Nintendo. We found those in a single outlet each, and Nintendo hasn't linked its maintenance to PHP, so treat them as unconfirmed.
Is php2shell being exploited right now?
Security firms disagree on how far attacks have gone, and the difference matters for how fast you move. Here is where each source stood between 21 and 23 October:
watchTowr is the most alarmed, while Cloudflare reports attack traffic without a confirmed success. CISA's Known Exploited Vulnerabilities (KEV) list is the US government's register of bugs with proof of real attacks, and it added these two on 26 October, after a confirmed break-in on an unpatched honeypot (see the update below). For the first two days attackers were clearly trying, and nobody publicly confirmed a successful break-in. That gap is exactly why so many teams went offline: they didn't want to be the first confirmed victim. Since 22 October the gap has narrowed: the Dutch NCSC is looking into first signs of success, and VulnCheck showed that ASLR, the standard memory protection on real servers, can be beaten. The reports from 23 October point the other way for now: Sophos, Previdian and Hunt.io all saw attempts fail, and SOCRadar found an attacker's ready-made exploit that matched none of the sites it was pointed at. Attackers are clearly struggling to get a reliable exploit, and the 34.4 million exposed services Censys counts give them plenty of time to keep trying. Late on 23 October one of them got through: Unit 42 confirmed a break-in at a European government body. Exploits are hard to make reliable, but they work on some real targets, so treat every unpatched server as at risk.
One more warning from Tenable: code shared online as a php2shell "proof of concept" is unverified and may carry malware. Don't run it to test your own site.
Why did companies with big security teams switch off instead of patching?
Patching a game backend or a government portal takes more than one command. Teams have to find every server and container that runs PHP, including copies bundled inside other products, test the new build, roll it out and restart workers. That takes hours or days.
Three facts made those hours dangerous. The flaws leaked before hosts and Linux distributions had their packages ready. The attack can fire before any application code runs, so app-level defences don't stop it. And PHP's own interim settings (a lower post_max_size, turning off session upload progress, and others) don't make a site safe, according to the advisory.
So the risk maths was simple. A few hours of maintenance costs some angry players and support tickets. A server takeover costs user data, regulator reports and weeks of cleanup. Pokémon, Cygames and governments picked the cheap loss.
Should your startup take its website offline because of PHP?
Most founders don't need to. Many hosts patched fast: GoDaddy, for one, said on 21 October that every PHP version on its Managed WordPress plans was patched and customers needed to do nothing. Hostinger finished patching all its hosting servers except VPS on the morning of 22 October, and cPanel, Plesk, DirectAdmin and CloudLinux shipped patched PHP builds, according to SecurityWeek. Ubuntu shipped fixed packages on 21 October, and Debian has fixed packages for its two current releases. Hosted builders such as Tilda, Wix and Shopify run their own platforms, so their customers don't install PHP updates themselves.
Going offline makes sense when patching today isn't possible. Use this split:
PHP 8.1 and older gets no official release. Minimal source backports exist for 7.4, 8.0 and 8.1, and some distributions and hosts ship them. If nobody has applied one to your server, that site stays exposed until it moves to a supported version.
How do you take a PHP site offline safely?
WordPress and Magento maintenance modes don't help here, because the bug triggers while PHP reads the request, before WordPress even starts. You have to stop requests before they reach PHP.
- Block at the edge. On Cloudflare, a rule that serves a static page or blocks traffic to the site works. On your own server, point the virtual host to a plain HTML folder, or stop PHP-FPM and serve a static page. Ask your host to do it if you're on shared hosting.
- Keep the notice static. One HTML file with your logo, a sentence on what's happening and an email address. No PHP, no forms.
- Say what's happening. Pokémon and Cygames left players guessing about return times, and the gaming press filled the gap. A two-line update on your status page, newsletter and social accounts stops the rumours.
- Patch, then verify. Install the fixed release or your distribution's package, run php -v to confirm the version, and restart every PHP worker, so no old code stays in memory.
- Check before you reopen. Look for files changed in the last days, new admin users and odd uploads. If anything looks wrong, keep the site closed and get help.
Here's a message you can copy for customers: "We've taken our site offline for a few hours to install an urgent security update for PHP, the software it runs on. Your data is safe and no attack has been detected. We expect to be back by [time], and you can reach us at [email] meanwhile." Only say "no attack has been detected" after you've checked your logs.
What does the PHP issue mean for you?
- Find every PHP site you own today. That includes old landing pages, staging copies and the forum nobody uses. The Ogi Networks breach started with a test account left behind for 12 years, and forgotten systems are where attackers start.
- Get a written yes from each host. Ask: is the PHP security release from 21 October installed on my plan? Save the reply. Ask in the same email whether session.upload_progress.enabled is set to 0, the setting PHP recommends since 23 October until its next release.
- Switch off what you can't patch. A site that is offline for a day costs you less than a site that serves malware to your customers and gets flagged by Google.
- Check servers that ran unpatched. In the one confirmed break-in, attackers had password hashes and multi-factor secrets within two hours. If a PHP server of yours ran unpatched after 17 October, ask your host or developer to look for new files, new admin users and odd uploads, and change the passwords and reset the two-factor setup of every account that server stores or signs in to.
- Put a firewall in front of everything. Cloudflare says its free plan includes rules for these flaws. That buys time and stays a stopgap.
- Write a one-page shutdown plan. Who can switch the site off, how, and what you tell customers. Keep it with your back-office stack notes. This week it was PHP; last week the Revolut outage showed how one supplier failure stops a business.
- Plan the move off old PHP. PHP 8.2 loses security support on 31 December 2026, so anything on 8.2 or older needs an upgrade date in the calendar. This week showed the bill for waiting: two Japanese games closed for good because their PHP was too old to patch, and Cygames needs more than a week to upgrade Rage of Bahamut.
If you're building your first security habits, start with our guide on how to build security into a startup, and follow the month's incidents in our cybersecurity news for October 2026.
Are you getting customers from ChatGPT yet?
More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.
👉 Rank on ChatGPT
What we know so far
Update 30 Oct, 07:40 CET: exploitation is now official, and most services are back. On 26 October BleepingComputer reported that Adel Karimi, detection and response lead at Perplexity, recorded confirmed remote code execution on a honeypot running Apache mod_php with PHP 8.4.26, an unpatched version. He notes that the test used a deliberately favourable single-worker setup, so it doesn't show how reliable the exploit is elsewhere. The same day CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog, with a 29 October deadline for US federal agencies. PHP also published rebuilt Windows packages on 26 October with Brotli 1.2.1, for a separate flaw (CVE-2026-111497) that only reaches Windows builds through cURL with automatic response decompression switched on. CVE-2026-115560 still has no fix: on 30 October php.net showed no new regular release, so keep session.upload_progress.enabled=0.
Wikimedia marked its maintenance as resolved at 17:36 UTC on 27 October, with Cloud Services "mostly restored". Its incident page, last edited on 29 October, says most Cloud VPS projects are back while some wait for their maintainers to upgrade PHP, and Toolforge now offers patched PHP 8.2 and 8.4 images. Quarry, Toolforge's admin page and Pageviews all loaded when we checked on 30 October. None of the operators that went offline has reported a compromise.
Update 25 Oct, 14:20 CET: the first confirmed break-in. In an update to its threat brief late on 23 October, Palo Alto Networks' Unit 42 described one case in which attackers exploited the flaws at a government body in Europe. Within two hours they had password hashes and multi-factor authentication secrets, built a tunnel into the organisation's Active Directory and tried to make themselves domain administrators. Unit 42 doesn't name the victim or say whether that last step worked. It also says the attackers' commands look like the work of an agentic AI attack platform: short batches of tasks, output labelled for a model to read, and quick changes of tactic after each failure. Unit 42 counts more than 22.6 million exposed instances that may be vulnerable.
Wikimedia marked its maintenance as resolved at 17:36 UTC on 27 October, with Cloud Services "mostly restored". Its incident page, last edited on 29 October, says most Cloud VPS projects are back while some wait for their maintainers to upgrade PHP, and Toolforge now offers patched PHP 8.2 and 8.4 images. Quarry, Toolforge's admin page and Pageviews all loaded when we checked on 30 October. None of the operators that went offline has reported a compromise.
Update 25 Oct, 14:20 CET: the first confirmed break-in. In an update to its threat brief late on 23 October, Palo Alto Networks' Unit 42 described one case in which attackers exploited the flaws at a government body in Europe. Within two hours they had password hashes and multi-factor authentication secrets, built a tunnel into the organisation's Active Directory and tried to make themselves domain administrators. Unit 42 doesn't name the victim or say whether that last step worked. It also says the attackers' commands look like the work of an agentic AI attack platform: short batches of tasks, output labelled for a model to read, and quick changes of tactic after each failure. Unit 42 counts more than 22.6 million exposed instances that may be vulnerable.
On 24 October TechCrunch reported that Palo Alto Networks and Trail of Bits had both seen confirmed compromises and activity after a break-in, without naming victims. The Dutch NCSC takes a calmer line in its update of 23 October, 15:43: it knows of one report of possible abuse abroad, not confirmed as successful, and says further research shows the flaws are complicated to exploit, so large-scale abuse is less likely than it first estimated. CISA's Known Exploited Vulnerabilities catalogue, updated on the evening of 23 October, still doesn't list either flaw, and PHP hasn't released a new version since 21 October.
Wikimedia is partly back: Toolforge's admin page and the Pageviews tool loaded again when we checked at 13:18 UTC on 25 October, while the Quarry database tool still showed an error and Wikimedia's status page still lists the maintenance as unresolved.
Update 23 Oct, 14:24 CEST: PHP published an informational advisory on a third issue, CVE-2026-115560, at 10:12 UTC. It calls it an "unlikely RCE vector": it only works when an app switches its session serializer to php at runtime with ini_set() before starting the session, while session upload progress is still on. The workaround is the setting PHP already listed on 21 October, session.upload_progress.enabled=0, so anyone who applied it then has nothing more to do. PHP will fix it in its next regular release, and The Hacker News notes that the 21 October releases don't cover it and that no attacks on it have been reported. On the shutdowns: SEGA brought its product information site back at 11:30 JST on 23 October and says it found no unauthorised access, Sakura Internet finished all its emergency maintenance with no damage reported, and 4Gamer reports Granblue Fantasy and the other Cygames titles back, except Rage of Bahamut. Wikimedia's Phabricator and documentation are back, while Toolforge still returned an error at 12:20 UTC. In the UK, the tech minister told the House of Lords on 22 October that 32 government services were unavailable and 4 partly unavailable, and that the NCSC had sent 50,000 warnings to organisations, according to The Register.
On attacks, 23 October: The Hacker News gathered the numbers. Cloudflare saw millions of attempts by early 22 October, Sophos says attackers failed to install a Mirai botnet variant called Potassium, and Previdian's and Hunt.io's decoys recorded no successful code execution. Censys still counts more than 34.4 million vulnerable PHP services. SOCRadar found an attacker's one-click exploit for PHP 8.4.26 on an exposed server, with no sign it got a shell on any of the sites it screened. At that point no break-in had been publicly confirmed (Unit 42 reported the first one later that day, see the update above), CISA still hasn't listed the flaws as known exploited, and PHP hasn't released a new version since 21 October.
Update 23 Oct, 07:30 CEST: most of the big names are back. Pokémon Champions returned first in the early hours of 22 October, Pokémon HOME followed a few hours later and Pokémon Sleep finished its maintenance that morning, according to Nintendo Life. Pokémon Sleep's own notice says stability fixes are done and promises every player a gift as an apology, without naming PHP. Sony Store Japan was usable again by the evening of 22 October, a Sony retailer's blog reported. Wikimedia's Toolforge and several Cloud VPS tools still didn't load when we checked at 05:20 UTC on 23 October. New shutdowns came too: Orange temporarily suspended some websites, services and apps across several subsidiaries on 22 October as a preventive step, and says patches are already on most of the affected sites. In Japan, Cygames says Rage of Bahamut will stay in maintenance for more than a week because it has to move from an old PHP version across several generations, according to Dengeki Online, and two older games, World Quest and Boku no Makai wo Sukutte!, closed for good because their systems couldn't be patched safely.
On attacks: Amazon says its decoy servers caught a first attempt on 17 October, four days before the fix, and that the flaws are "now being broadly exploited in the wild", while it's unclear whether any attempt succeeded. At 16:00 on 22 October the Dutch National Cyber Security Centre (NCSC) said it is investigating first signs of successful abuse. Late that day VulnCheck said it built an exploit that runs code on x86-64 servers with PHP's recommended production settings and ASLR, a standard memory protection, switched on, for PHP 8.4.10 to 8.4.26. It shares the exploit only with paying customers. Of the hundreds of public proofs of concept on GitHub, VulnCheck found at least one that beats ASLR, and only on PHP 8.4.26. VulnCheck's Spencer McIntyre told The Register that "the technical difficulty of exploiting a vulnerability shouldn't be confused with protection against it." No break-in has been publicly confirmed, CISA still hadn't listed the flaws as known exploited on the morning of 23 October, and PHP hasn't released anything new since 21 October.
- 19 to 24 August 2026: Wiz finds the first bug and reports it to PHP.
- 17 October: Amazon's honeypots record a first exploitation attempt, before the fix.
- 20 October: PHP announces an emergency release after details leak.
- 21 October, 03:02 UTC: Cloudflare's firewall rules go live for all plans.
- 21 October, 14:00 UTC: PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- 21 October: Ubuntu ships fixed packages; GoDaddy says Managed WordPress is patched.
- 21 October: Pokémon, Cygames, Wikimedia and government sites across Europe go offline as a precaution; watchTowr reports exploitation attempts.
- 22 October, morning: Pokémon Champions, Pokémon HOME, Pokémon Sleep, Umamusume, Shadowverse, pixiv and BOOTH are reported back online.
- 22 October: Orange temporarily suspends some sites and apps across several subsidiaries; World Quest and Boku no Makai wo Sukutte! announce they are closing.
- 22 October, 16:00: the Dutch NCSC says it is investigating first signs of successful abuse and that several sites are back online.
- 22 October, evening: Sony Store Japan is usable again; Cygames says Rage of Bahamut needs more than a week; VulnCheck says its exploit works on production-configured servers.
- 22 October: the UK tech minister says 32 government services are unavailable and 4 partly unavailable.
- 23 October, 02:30 UTC: SEGA's product information site returns, with no damage found.
- 23 October, 10:12 UTC: PHP flags a third issue, CVE-2026-115560, and recommends session.upload_progress.enabled=0 until its next release.
- 23 October, afternoon: a Japanese survey counts 502 shutdown notices, about 60% without a restart notice; CISA still hasn't listed the flaws; Wikimedia's Toolforge is still offline.
- 23 October, 15:43 CEST: the Dutch NCSC says the flaws are complicated to exploit and large-scale abuse is less likely than first thought.
- 23 October, 19:30 UTC: Palo Alto Networks' Unit 42 reports the first confirmed compromise, at a European government body.
- 25 October: Toolforge's admin page and Pageviews load again, Quarry is still down; CISA still hasn't listed the flaws.
- 26 October: a confirmed break-in on an unpatched PHP 8.4.26 honeypot is reported; CISA adds both CVEs to its exploited list; PHP rebuilds its Windows packages for a Brotli flaw.
- 27 October, 17:36 UTC: Wikimedia marks its Cloud Services maintenance resolved, functionality mostly restored.
- 30 October: Quarry loads again; CVE-2026-115560 still has no fix.
- 5 November: php.net still lists no regular release fixing CVE-2026-115560; the session.upload_progress.enabled=0 workaround stays in place.
Open questions
- Which European government body Unit 42 found compromised, whether the attackers became domain administrators, and whether other victims are confirmed.
- When PHP's next release fixes CVE-2026-115560, and which versions it affects.
- When the last Wikimedia Cloud VPS projects and Cygames' Rage of Bahamut come back, and when Wikimedia publishes its post-incident summary.
- Whether a working exploit for production servers becomes public.
- How many of the 34.4 million PHP services Censys counts as vulnerable get patched, especially those on PHP 8.1 and older.
- PHP vulnerability: the news, the fixed versions and the patch plan (mean.ceo)
- A no-developer plan for small business websites (Fe/male Switch Foundation)
- A 24-hour plan for freelancers who look after client sites (Fe/male Switch)
- What engineering teams must patch to protect portals and CAD files (CADChain)
Running one small business website with no developer? Use the Fe/male Switch Foundation's no-developer plan. Looking after client sites? femaleswitch.com has a 24-hour plan for freelancers, and engineering teams can follow CADChain's checklist for portals that hold CAD files.
FAQ: the PHP issue and the websites that went offline
Why are so many websites down because of PHP?
Two flaws in PHP, fixed on 21 October 2026, let attackers run code on servers without logging in. PHP says no setting fully protects you, so operators that couldn't patch at once, such as Pokémon, Cygames, Wikimedia and several European governments, took services offline as a precaution.
Were Pokémon HOME and the other services hacked?
None of these operators has reported a compromise. The one confirmed break-in so far, reported by Palo Alto Networks' Unit 42 on 23 October, hit an unnamed European government body. The shutdowns were described as precautions, and Cygames cited system safety. Pokémon Champions, Pokémon HOME and Pokémon Sleep were all back online on 22 October, and Pokémon Sleep promised every player a gift as an apology.
Is the PHP vulnerability being exploited?
Attack attempts are confirmed and run into the millions: Amazon saw the first one on 17 October, and watchTowr and Cloudflare report many more. On 22 October the Dutch NCSC said it is investigating first signs of successful abuse, and VulnCheck built an exploit that works on production-configured servers. The reports from 23 October, by Sophos, Previdian, Hunt.io and SOCRadar, describe failed attempts. Late on 23 October Palo Alto Networks' Unit 42 reported the first confirmed compromise: attackers took password hashes and multi-factor authentication secrets from a European government body within two hours. On 26 October a confirmed break-in on an unpatched PHP 8.4.26 honeypot was reported, and CISA added both flaws to its Known Exploited Vulnerabilities catalog.
Why did some games shut down for good over PHP?
Two older Japanese games, World Quest and Boku no Makai wo Sukutte!, announced they were closing because their systems were too old to patch safely and moving them to a new PHP wasn't realistic. Cygames is keeping Rage of Bahamut alive, but its maintenance will last more than a week while it upgrades PHP across several versions. Old PHP is technical debt, and this week it came due.
Is there a new PHP vulnerability after php2shell?
Yes, a narrower one. On 23 October PHP flagged CVE-2026-115560, which only affects apps that switch their session serializer to php at runtime while session upload progress is on. PHP recommends setting session.upload_progress.enabled=0 until its next regular release, which will carry the fix and the full advisory. No attacks on it have been reported.
Which PHP version fixes the issue?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.1 and older get no official release, only minimal source backports for 7.4, 8.0 and 8.1 that distributions and hosts may ship. These releases don't fix the third issue, CVE-2026-115560, so keep session upload progress switched off until PHP's next release.
Should I take my WordPress site offline?
Only if it can't be patched today. If your host confirms the fixed PHP is installed, stay online. If you run PHP 8.1 or older with no backport, or nobody can update the server, block traffic before it reaches PHP until it's fixed. WordPress maintenance mode doesn't protect you.
Is my Tilda, Wix or Shopify site affected?
Hosted builders run their own servers and handle updates themselves, so you don't install PHP. If your site also uses a separate WordPress blog or a custom PHP tool, check those with their host.
About the Author
Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
